The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes importlib.import_module and __import__ to dynamically load provider-specific logic (e.g., github_ops, gitlab_ops) and build system parsers. The target module names are derived from external configuration files (marshal.json), and the script modifies sys.path at runtime to include sibling skill directories (e.g., build-maven/scripts). This pattern allows for dynamic code loading from paths computed at execution time, which could be exploited if an attacker can manipulate the configuration or the local filesystem structure.
[COMMAND_EXECUTION]: The skill frequently executes shell commands using subprocess.run to interact with git, gh (GitHub CLI), and glab (GitLab CLI). While the implementation uses list-based arguments rather than raw shell strings to mitigate direct command injection, the broad range of operations (creating PRs, merging branches, fetching logs) exposes a significant attack surface if user-supplied input—such as branch names, titles, or body content—is not strictly validated by the underlying CLI tools.
[EXTERNAL_DOWNLOADS]: The skill automatically downloads raw CI logs from GitHub and GitLab when failures are detected. These logs are fetched via authenticated CLI calls (gh run view --log-failed, glab ci trace) and saved to local artifact directories. While the sources are trusted platforms, the logs constitute untrusted external data that is subsequently processed by the skill's filtering logic.
[INDIRECT_PROMPT_INJECTION]: The skill processes and presents CI failure logs to the agent. These logs could potentially contain malicious instructions intended to manipulate the agent's behavior (indirect prompt injection). The skill lacks specific sanitization for LLM instructions within the ingested logs, relying only on regex-based filtering to extract error context.
[DATA_EXFILTRATION]: The skill reads sensitive information from CI provider APIs, including PR comments, review details, and build logs. This data is written to local files under the artifacts/ directory. While this is the intended functionality for CI triage, a compromised environment could leverage these scripts to harvest and centralize repository data.

tools-integration-ci